VIRUS TECHNOLOGY

view Presentation

The term virus is as old as hills are now in the world of computer technologies. A virus basically is software that is made to run automatically usually used for destructive purpose by the computer experts. Though virus is a well known but not known well.
Definition : A computer virus is a coded program that is written in Assembly or a system programming language such as ‘C’ to deliberately gain entry into a host system and modify existing programs and/or perform a series of action, without user consent.

In this paper we would like to throw light on some of the unturned stones of the world of virus. We would start from history of the virus i.e. who created the first virus, for what purpose and hoe it affect to the computer. Then classification of viruses by to different methods:
Ø General classification of the virus.
Ø Behavioral classification of the virus. We covered the topic how nowadays viruses affects to the Mobiles, how they come to the mobile. The small and most important topic that we covered is the ‘Positive Virus’. We covered how the virus actually works in the host computer along with one example as they would enlighten our knowledge about viruses, this is because we want to secure of viruses and actually need to known how are they programmed and executed automatically. We also covered some information about the most popular viruses with some vital information i.e. how they work, how much harmful to the host etc. At last we covered the solution for the virus i.e. Anti-virus. In this topic we covered how to detect the computer virus, how anti-virus works. AN INTRODUCTION TO VIRUSES

In the mid-eighties, so legend has it, the Amjad brothers of Pakistan ran a computer store. Frustrated by computer piracy, they wrote the first computer virus, a boot sector virus called Brain. From those simple beginnings, an entire counter-culture industry of virus creation and distribution emerged, leaving us today with several tens of thousands of viruses.
In just over a decade, most of us have been familiar with the term computer virus. Even those of us who don’t know how to use a computer have heard about viruses through Hollywood films such as Independence Day or Hackers (though Hollywood’s depiction of viruses is usually highly inaccurate). International magazines and newspapers regularly have virus-scares as leading stories. There is no doubt that our culture is fascinated by the potential danger of these viruses.
Many people believe the worst a virus can do is format your hard disk. In fact, this type of payload is now harmless for those of us who back up our important data. Much more destructive viruses are those which subtly corrupt data. Consider, for example, the effects of a virus that randomly changes numbers in spreadsheet applications by plus or minus 10% at a stockbroker. Other nasty viruses post company confidential documents in your own name to some of the atlases Internet newsgroups, an act, which can both, ruin your reputation and the company’s confidentiality.
Despite our awareness of computer viruses, how many of us can define what one is, or how it infects computers? This paper aims to demystify the basics of computer viruses, summarizing what they are, how they attack and what we can do to protect ourselves against them.
DEFINITION:-
“A computer virus is a coded program that is written in Assembly or a System programming language such as ‘C’ to deliberately gain entry into a host system and modify existing programs and/or perform a series of action, without user consent. In addition, a virus is designed to replicate copies of itself in order to spread the infection widely among other uninfected programs and systems.”
A virus is nothing more than a program. A virus is a serious problem for everyone in the information technology industry. Viruses range from the harmless programs displaying a character on your screen to the malicious codes which go on to format your entire hard-disk.
Just like a biological virus that takes over a living cell, a computer virus containing a set of coded instructions, also invades a host system and tries to replicate and infect new hosts. A sophisticated virus can spread undetected for a long time, waiting for a signal to begin destroying or altering data. A signal can be in the form of date, or a change in a system resource data, etc.
The difference between a computer virus and other programs is that viruses are designed to self-replicate (that is to say, make copies of themselves). They usually self-replicate without the knowledge of the user. Viruses often contain ‘payloads’, actions that the virus carries out separately from replication. Payloads can vary from the annoying (for example, the WM97/Class-D virus, which repeatedly displays messages such as “I think ‘username’ is a big stupid jerk”), to the disastrous (for example, the CIH virus, which attempts to overwrite the Flash BIOS, which can cause irreparable damage to certain machines).
Many people believe the worst a virus can do is format your hard disk. In fact, this type of payload is now harmless for those of us who back up our important data. Much more destructive viruses are those which subtly corrupt data.
Viruses can be hidden in programs available on floppy disks or CDs, hidden in email attachments or in material downloaded from the web. If the virus has no obvious payload, a user without anti-virus software may not even be aware that a computer is infected.
A computer that has an active copy of a virus on its machine is considered infected. The way in which a virus becomes active depends on how the virus has been designed, e.g. macro viruses can become active if the user simply opens, closes or saves an infected document.

A BRIEF HISTORY OF VIRUSES

Over the past decades, the computer viruses have evolved through numerous avatars. From being rather 'dumb', they have developed into programs exhibiting surprising 'smart¬ness'. We give you an overview of how viruses have devel¬oped over time.
1950'S-1970:THE PRE-HISTORIC PERIOD
The viruses, as we know them now, actually started out in unpretentious surroundings of research laboratories. In the 1950's, researchers studied, what they called as-'Self-altering Automata' programs. Simple program codes were writ-ten to demonstrate rather limited characteristics. In a way, these programs were the pre-historic (in a manner of speaking) ancestors of the modern virus.
In the 1960's computer scientists at the Bell Laboratories had viruses battling each other in a game called Core Wars. The object of the game was to create a virus small enough to destroy opposing viruses without being caught. Like computers, viruses too were studied keeping in mind their military implications. Of course, several research foundations too worked on the non-military uses of viruses.
1970'S-1980:THE EARLY TIMES
This was the time when the term 'VIRUS' gained recognition by moving from the research labs to the living rooms of common users. Science fiction novels in the early 1970's were replete with several instances of viruses and their resultant effects. In fact, an entire episode of the famous science fiction TV series, Star Trek, was devoted to viruses. Around the same time, researchers at the Xerox Corp. demonstrated a self-replicating code they had developed.
By now, the use of computers had proliferated to include most government and corporate users. These computers were beginning to be connected by networks. Several or-ganizations began working on developing useful viruses which could help in improving productivity.
1980'S-1990:THE MIDDLE AGES
While on the one hand, the exponentially increasing use of computers and their availability proved to be a boon to the common users, on the other hand, the ugly faces of compu¬ter viruses also made their appearances. From the compu¬ter-science labs, viruses fell into the hands of cyberpunks -unprincipled programmers; who obtained sadistic pleasures from ruining computer systems across the globe.
Among the earliest instances of malicious uses of viruses was when Gene Burelon a disgruntled employee of a US securities firm, introduced a virus in the company computer network and managed to destroy nearly 1, 68,000 records of the corporate database. In October 1987, the (c) Brain virus, later to be known as the 'Pakistani' virus, was found to be working its way quietly through the computer systems in¬stalled at the University of Delaware. This was probably the first mass distributed virus of its kind. In 1988, the so-called Internet Virus was responsible for the breakdown of nearly 6000 UNIX based computers connected to the Internet network in the US. Other well known viruses that made their appearances were Cascade, Jerusalem, Dark Avenger, etc. During this decade, viruses were written to attack different operating software platforms such as, DOS, MAC, UNIX, etc.
1990'S-2004:THE CURRENT PICTURE
The early part of the 1990's was witness to development of sophisticated strains of existing viruses. It was more of a matching of wits between the developers of viruses and the developers of anti-virus programs. In addition to plugging the loopholes in existing viruses, a new family of viruses called the Macro Viruses also made their appearance. These viruses affected files created in the popular MS Word and MS Excel programs.
The decade of the 1990's has seen more and more virus developers writing stealth virus codes giving rise to sophis¬ticated viruses such as the Zero Hunt virus, the Michael Angelo virus, etc. In addition, viruses written to invade net¬worked environments have also come into being, in line with the increasing use of communication networks. The Year 2000 problem, in all probability, will generate families of new viruses which will come in the guise of Y2K solution programs.

2005-2015: THE EMERGING SCENARIO
The first decade in the next millennium will see the generation of the 'intelligent viruses' displaying fuzzy logic characteristics. These viruses will be programmed to alter their codes as and when they detect the presence of anti-virus programs. They will not only attack the traditional computer systems and communication networks, but also, software controlled components in cars, trains, air-traffic control systems, defense equipment, etc. The virus developers in all likelihood will include more and more young adolescents and even, children." Viruses will become the new tools of terrorism; giving rise to 'Cyber Terrorists'.
Since Internet will connect the farthest corners of the globe, the time it takes for a virus to proliferate will be greatly reduced. However, on the flip side, special software development tools will be available to common users to automatically develop anti-virus programs to counter most virus threats.

CLASSIFICATION OF VIRUS: -

There are mainly two methods for classification of the viruses. While classifying a particular virus, we have to keep in mind the general, as well as the behavioral aspects of the virus. Most viruses are designed to exhibit a mixture of properties. Hence, a particular virus can be a file virus, a direct action virus, as well as a stealth virus. Or, a virus can be a boot sector virus, a transient virus, as well as a poly¬morphic virus.

FILE VIRUSES
File viruses are designed to enter your system and infect program and data files. Program files are those files which contain coded instructions, necessary to run or execute software programs. These program files are generally ap¬pended by .COM or .EXE file extensions. However, some file viruses can also infect other executable files, having file extensions such as, .SYS, .OVL, .PRG, .MNU, etc. The program files, most prone to file virus attacks include oper¬ating software, spreadsheets, word processors, games and utilities program files. The data files, susceptible to virus attacks are those that have been created using popular programs, such as, MS-Word, MS-Excel, etc. Usually, such files are attacked by Macro virus A file virus, ordinarily enters the system when you copy data or start your system using an infected floppy disk or, download an infected file from a networked system or, use infected software obtained from unauthorized sources. Once in your system, depending upon the virus code, the virus can either infect other program or data files straightway or, it can choose to hide itself in the system memory (RAM) for the time being. Then, at an appropriate time or if certain system conditions are met, it begins to infect other executed program or data files. The virus infects a program or a data file by replacing part of the original file code with a new code. This new code is designed to pass the actual control of the file to the virus. The virus normally attaches itself to the end of the host file. On execution of an infected file by the user, the virus makes sure that the file is executed properly; to avoid sus¬picion. However, it uses this opportunity to infect other files. At the same time, the virus keeps tabs on the various system resources, so that at an appropriate time (depending upon the virus code), it can unleash its destructive activities. It is interesting to note that most viruses do not infect an already infected file. This is to prevent the file from becoming too large. Because then, the system would be compelled to display the message 'Not enough memory,' thus alerting the user to the possibility of a virus attack. Examples of file viruses are Vienna, Jerusalem, Concept Word Macro virus, etc., BOOT SECTOR VIRUSES A boot sector virus attacks the boot sectors of floppy disks and the master boot records (boot sectors and partition tables) of hard disks. Hence, the boot sector viruses can be sub-divided into the following categories: • Floppy Disk Boot Sector Viruses: As the name suggests, these viruses infect the floppy disk boot sectors only.

• Hard Disk MBR Viruses :
These viruses infect the master boot records, that is, the partition tables of the hard disks. These viruses are also designed to infect the boot sectors of the floppy disks.
A boot sector virus, like other viruses, enters the system when you copy data or start your system using an infected floppy disk or, download an infected file from a networked system or, use infected software obtained from unauthor¬ized sources.
A boot sector virus typically replaces the boot sector (on the first track of the disk) with a part of itself. It then hides the rest of the virus code, along with the real boot sector, on a different area of the disk. In order to avoid detection, this area is marked as a bad sector by the virus. A boot sector virus can also hide itself in the system area of the disk.
From now onwards, whenever the system is turned on (that is, booted), the virus is also loaded in the system memory (RAM). The virus ensures that the real boot sector starts the machine normally. After the startup, the virus takes over and monitors and controls the critical system resources.
On completion of a certain time period or after certain system conditions are met, the virus carries out its designed activities. These activities may range from merely displaying a harmless message on the screen, to irreversibly crashing your hard disk.
This type of virus spreads its infection widely by infecting the boot sectors of other floppy disks inserted in the infected machine. Most boot sector viruses do not infect an already infected disk.
These viruses can be very complex in character and are capable of seriously jeopardizing the working of the infected systems. Some of the examples of Boot Sector viruses include Brain, Stone, Empire, Michelangelo, etc.
DIRECTORY VIRUSES
These viruses are also called as Cluster Viruses and are programmed to modify the directory table entries in an infected system.
A directory virus, like other viruses, enters the system when you copy data or start your system using an infected floppy disk or, download an infected file from a networked system or, use infected software, obtained from unauthor¬ized sources.
The virus, on entering your system, resides in the last cluster of the hard disk. Also, it modifies the starting cluster addresses of all the executable files, by inserting references to the virus address in the File Allocation Table (FAT).
The files themselves are not infected, only their starting cluster addresses are altered, so that every time the file is executed, the virus also becomes active and loads into the system memory. The virus allows the actual program to proceed unhindered (for the time being) in order to avoid detection. Also, the virus, when loaded in memory, contin¬ues to show the original starting cluster address of the file, so as to confuse the user. Like other viruses, this type of a virus also disrupts the smooth working of your system.
These viruses are very intelligent and spread faster than other classes of viruses. Examples of these viruses are DIR II, DIR III, DIR BYWAY, etc.
HOAXES
Psychologists the world over attributes the proliferation of viruses to the constant human desire for recognition and admiration from fellow beings. While some virus developers are smart enough to write and develop innovative viruses (of course, if they could use their ingenuity for more construc¬tive work, the world would be a better place to live in), there are others who would not like to waste time on such work. They would rather gain notoriety in more resourceful ways such as, simply claiming to have developed a virus; without actually having done so.
While visiting a BBS or surfing the Internet, one often comes across information announcing the discovery of a new virus. It is in your interest to take such information with more than a pinch of salt. Please do not take this to mean that you have to lower your guard against suspected viruses. Only, you must make it a point to substantiate the veracity of the information before taking any action.
Should you come across a suspected hoax regarding a virus, keep in mind the following checklist while going through the information:
• Before accepting a statement, find out more about its source. Look for references that can be cross-checked for authenticity.
• Most hoaxes, while deliberately posted, die quick deaths because of their outrageous contents. Try to separate the chaff (junk) from the grain (contents). Look for technical details that can be rationalized.
• Cross-check the technical details with a known expert in the subject.
• Keep track of who else might have received the same information as you. Get in contact with them to elicit their response to the information.
• Look for the location of posting of the 'information. Should the posting be in an inappropriate newsgroup, be suspi¬cious.
• Look at the name of the person posting the information. Is it someone who is clearly identifiable and is an expert in the field?
• Double check the information with other independent sources such as, other sites, other BBSs, etc,
To give you an idea what a hoax looks like, listed below are some of the more notorious hoaxes that have been floating around in cyberspace.
Good Times Virus: The information about this virus when reported, sounded like a sincere warning; issued by naive though, caring users. This virus was supposed to wipe out the data on the system hard disk. Some variations of this theme were the Deeyendra Virus Alert and the Pen Pal Virus Alert- also found to be hoaxes.
Irina Virus:
This was a marketing ploy employed by the UK publishing giant, Penguin Books, to generate reader interest in the latest release of one of their books. Despite a subsequent correction, the virus seemed to have caught the fancy of quite a few computer users.
The Porno GIF Virus:
This virus was purported to be hidden in a pornographic .GIF graphics file and contained indecipherable text in it. Since such contents are indicative of a virus or a Trojan program, this hoax was also believed by many to be true.

MACRO VIRUSES
A macro is an instruction that carries out program commands automatically. Many common applications (e.g. word processing, spreadsheet, and slide presentation applications) make use of macros. Macro viruses are macros that self-replicate. If a user accesses a document containing a viral macro and unwittingly executes this macro virus, it can then copy itself into that application’s startup files. The computer is now infected— a copy of the macro virus resides on the machine.
Any document on that machine that uses the same application can then become infected. If the infected computer is on a network, the infection is likely to spread rapidly to other machines on the network. Moreover, if a copy of an infected file is passed to anyone else (for example, by email or floppy disk), the virus can spread to the recipient’s computer. This process of infection will end only when the virus is noticed and all viral macros are eradicated.
Macro viruses are the most common type of viruses. Many popular modern applications allow macros. Macro viruses can be written with very little specialist knowledge, and these viruses can spread to any platform on which the application is running. However, the main reason for their ‘success’ is that documents are exchanged far more frequently than executables or disks, a direct result of email’s popularity and web use.
TROJAN HORSE
A Trojan horse is a program that does something undocumented which the programmer intended, but that the user would not approve of if he or she knew about it. According to some people, a virus is a particular case of a Trojan horse, namely one which is able to spread to other programs (i.e., it turns them into Trojans too). According to others, a virus that does not do any deliberate damage (other than merely replicating) is not a Trojan. Finally, despite the definitions, many people use the term "Trojan" to refer only to a non-replicating malicious program.
PARASITIC VIRUSES
Parasitic viruses attach themselves to programs, also known as executables. When a user launches a program that has a parasitic virus, the virus is surreptitiously launched first. To cloak its presence from the user, the virus then triggers the original program to open. The parasitic virus, because the operating system understands it to be part of the program, is given the same rights as the program to which the virus is attached. These rights allow the virus to replicate, install itself into memory, or release its payload. In the absence of anti-virus software, only the payload might raise the normal user’s suspicions. A famous parasitic virus called Jerusalem has a payload of slowing down the system and eventually deleting every program the user launches.

BEHAVIORAL CLASSIFICATION OF VIRUSES
In addition to the general classification, viruses can also be classified according to the following behavior patterns exhibited by them:
• Nature of attack
• Deception techniques employed
• Frequency of infection
The chart in Figure Chapter 2-3 gives an overview of the behavioral classification of viruses.
NATURE OF ATTACK
Depending upon the way a virus attacks the various files, it can be classified as follows:
Direct Action Virus
A Direct Action virus is one that infects one or more program files; every time an infected file is run or executed. An example of such a virus is the Vienna virus.
Resident Virus
A Resident virus is one which hides itself in the system memory the first time a file, infected with this virus, is executed. After a programmed time period or when certain system conditions are met, the virus becomes active and begins to infect other programs and files. An example of such a virus is the Jerusalem virus.
DECEPTION TECHNIQUES EMPLOYED
Depending upon the way a virus employs the various deception techniques to avoid detection, it can be classified as follows:
Stealth Virus
A Stealth virus is one which hides the modifications made by it to an infected file or a boot sector. This it does by monitoring the disk input/output requests made by other programs. Should a particular program demand to view the infected areas or files on the disk, the virus ensures that the program reads the original uninfected areas; stored else-where on the disk by it. Hence, the virus manages to remain undetected for as long as possible. The Brain virus is an 'example of a Stealth virus.
Polymorphic Virus
A Polymorphic virus is one which produces multiple, but varied copies of itself; in the hope that the virus scanner will not be able to detect all its mutations. This type of virus carries out the infection while changing its code by using a variety of encryption (encoding) techniques. Since a virus scanner would also require a variety of decryption (decod¬ing) codes in order to decipher the various forms of the virus, the scanning process becomes cumbersome, difficult and unreliable. The Dark Avenger virus is an example of this type of virus
Armored Virus
This virus is one which uses special techniques to avoid its tracing and detection. An anti-virus program has to take into account the virus code in order to be effective. An Armored virus is written using a variety of methods so that disassembling of its code becomes extremely difficult. How¬ever, this also makes the virus size much larger. The Whale virus is an example of such a virus.
Companion Virus
A Companion virus is one, which instead of modifying an existing .EXE executable file, creates a new infected copy of the same file, having the same name; but, with a .COM file extension. Hence, whenever the user executes the program file by typing the name of the program at the DOS prompt, the COMMAND.COM file (the Command Interpreter) loads the infected copy of the file. This happens because the .COM files get precedence over the .EXE files. Since in this case, the original file remains unchanged, the virus scanner checking for modifications in the existing files, would fail to notice the virus.
Multipartite/Boot-and-File Virus
This type of virus infects the boot sector as well as the program files. Such viruses usually exhibit dual characteris¬tics. For example, a file virus of this category can also infect the system boot sector and vice-versa. Hence, such a virus becomes difficult to identify. The Tequila virus is an example of such a virus.
Batch File Virus
This type of virus is embedded into an especially written batch file. The batch file in the guise of carrying out a set of instructions in a particular sequence, actually uses the op¬portunity to copy the virus code to other batch files. Fortu¬nately, such viruses are not common.
Cavity Virus
Some program files have empty spaces inside them, for a variety of reasons. A Cavity virus uses this empty space to install itself inside the file, without in anyway altering the program itself.
Since the length of the program is not increased, the virus does not need to employ complex deception techniques. However such viruses are rare. The Lehigh virus is an example of such a virus.
Camouflage Virus
This type of virus is masked to look like a harmless virus-like code; a code that an anti-virus software is likely to ignore. Most anti-virus scanners have a built-in database of virus code data strings. Hence, while scanning a system, there is always a distinct possibility of a false alarm being raised by the scanner. This is particularly so when a system has more than one type of scanner installed in it.
Thus, in order to avoid panic reactions by users, most signature based virus scanners are designed to ignore virus codes that meet certain predetermined conditions. A Cam¬ouflage virus uses this chink in the anti-virus program's Armour to fool it by disguising itself as a harmless virus-like code and thus, escaping detection. Fortunately, most mod¬ern scanners check and cross-check a set of parameters before declaring a file to be virus free. Hence, it is difficult to hide such a virus; with the result that these viruses are not widely found.
Tunneling Virus
An anti-virus interception program keeps track of the system resources in order to detect the presence of a virus. It monitors the interrupt calls made by the various devices. A tunneling virus pre-empts this process by gaining direct access to the DOS and BIOS interrupt handlers. This it does by installing itself under the interception program. Some anti-virus scanners are able to detect such an action and may attempt to reinstall themselves under the virus. This results in interrupt wars between the virus and the anti-virus program, thus resulting in a hung system.

FREQUENCY OF INFECTION
A virus is programmed to propagate copies of itself by spreading the infection to other files within the system. A virus can also be classified according to the frequency with which it spreads the infection.
Fast Infector Virus
This type of virus is one which when active in system memory, not only infects the executed program files, but also, all files that are merely opened. With such a virus in 1 memory, should a scanner be in operation, it would result in all the files getting infected within a short period of time.
Slow Infector Virus
This type of virus, when in system memory, infects only those files which are created or opened. Hence, the user is fooled into thinking that the changes in the file size, as reported by the virus scanner, are due to legitimate reasons.
Sparse Infector Virus
This type of virus is designed to infect other files, only occasionally. For example, the virus may infect every 10th executed file, or only those files having specific lengths, etc. By infecting less often, such viruses minimize the possibility of being discovered.
STAGES IN THE LIFE CYCLE OF A VIRUS
The entire life cycle of a virus can be divided into the following stages.
CREATION
In this stage, a systems programmer creates the virus by writing its program code; using either Assembly language or a systems programming language such as 'C'. Usually, Assembly language code is the preferred choice of most virus programmers.
Various software-writing tools, available off-the-shelf or on various BBSs and Internet sites, can be used to write the virus code. The entire exercise can take anywhere from a few days to a couple of weeks to complete.
GESTATION
This refers to the stage wherein the virus developer secretly introduces the Virus into the outside world. This is done in a variety of ways. One way is to bundle the virus with a useful software utility or a games program and offer it to unsuspecting users. Another way involves introducing the virus through a network such as a public BBS, a company LAN or the Internet.
PROPAGATION
Viruses are designed to replicate copies of themselves and spread the infection exponentially, For example, one infected system infects two other systems, which in turn infect four systems and so on. Before you know it, an entire chain of infections is in progress.
In this stage, an infected system spreads the infection to other systems through the use of infected floppy disks and also by transferring infected files over a network. A network is the fastest way of spreading a virus. A 'good' virus design provides a virus with enough time to spread the infection widely, before being activated.
ACTIVATION
This is the stage where a virus becomes active and proceeds to carry out the designed activity. When and how a virus becomes active, depends on the 'trigger' mechanism of the virus. This 'trigger' may be in the form of a particular date (for example, on the 12th of June - the Independence Day of the Philippines) or, when certain system conditions are met (for example, after opening the 10th file).
The effects of the virus activity may range from simply displaying a harmless message on the screen, to completely formatting the hard disk and thus erasing all data on it. Some viruses, while not causing any outward damage, may use up scarce system resources such as RAM; thus slowing down the computer.
DISCOVERY
This is when a user notices the virus and successfully isolates it. When a virus has managed to propagate widely and infect a number of other systems, there may be several users, who individually or collectively, discover the presence of the virus. Usually, this stage is reached after the Activation stage. However, there have been cases where enterprising users have detected a virus even before it has had the time to activate itself.
As a rule of thumb, a virus is usually discovered at least a year before it has had the opportunity of becoming a major threat.
ASSIMILATION
After a virus is discovered and the information about it publicized, developers of anti-virus software analyze the virus code and develop vaccines for its detection and eradication. At times, even individual users may be able to devise vaccines for the virus.